0

I'm using a frida script to scan for a certain byte pattern when I launch an iOS app.

I can log each offset and confirm these are correct by also printing out the instructions at those locations and comparing them with the disassembly from ghidra.

The problem I am having is that I would like to also hook each of those locations. Below is the code I am using. If I comment out the hook.detach() command, the log commands will successfully print out the offsets and the app will run, but those locations will never be hooked (which I assume is as expected if the hook is detached). If I comment out the hook.detach() command, then the app will launch, it will log the offsets where the pattern is found, followed by the first offset being hooked, but the app will immediately crash at that point.

var m = Process.enumerateModules()[0];
var pattern = '01 10 00 D4 03 00 80 D2 63 00 03 9A';
// this represents:
// svc #0x80
// mov x3, #0
// adc x3, x3, x3
var results = Memory.scanSync(m.base, m.size, pattern);
var base = Process.enumerateModules()[0].base;

for (var result in results) {
    console.log('[+] pattern found:', results[result].address);
    var hook = Interceptor.attach(results[result].address, {
        onEnter: function(args) {
            console.log('[+] Hook triggered at:', results[result].address);
        },
    });
    //hook.detach();
}

Further information after more tests following @Robert's question.

If I launch the application from frida including an empty script, and then add the above to the script and save it with the application still running, it will find the offsets of the byte pattern and implement those hooks, but they are not called again by that point.

The byte pattern exists four times in the application I'm looking at. If I manually specify those offsets I can successfully attach to each one on it's own, suggesting it is not an issue with the location itself, but if I try and attach to more than one at a time, in any combination, then frida will also immediately terminate. So it seems to be something to do with attaching to more than one location at launch. An example of the four memory locations returned are:

0x104a5c61c, 0x104a5d180, 0x104a5d1b4, 0x104a5d1fc

and if I substract the base base address of the module from these can again confirm in ghidra that the instructions I'm looking for are at those offsets.

2
  • I assume are searching for Frida's MemoryAccessMonitor. Interceptor.attach will only work if the pattern points to a function (not when it points into a function). What is represented by the pattern that you search?
    – Robert
    Jan 13 at 10:55
  • Hi @Robert, I have added a comment to the code snippet above of the instructions represented by the byte pattern and some other information following further investigation. I thought that it was possible to intercept at a specific offset, e.g. to read the contents of a register, such as I have done here reverseengineering.stackexchange.com/questions/27925/….
    – Jon
    Jan 15 at 10:58

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.